FTP access after validation of POP / or through website

[hkr]

Hi,

Recently I have experienced a number of cases when a user's account was broken into and malicious scripts installed, or content was modified/deleted etc.

Logs show that hackers had access to the FTP / account password, I assume they got it somehow from the user's PC which had the site password stored or keylogger, or...

So I need to introduce some more security.

I had the following idea: no FTP is to be allowed unless the client IP is in a whitelist. As clients normally use dynamic IP, I would authenticate their IP by telling the users to visit a web page first. Hosts that POP from the server would also be added to the temporary white list.

Is there a ready-made solution for the above or does anyone have any better ideas?
How would you implement this?

Rgds,

hkr

 

[zEitEr]

Hello,

Try it out, and see whether it works for you or not.

Replace FTP with sFTP.

 

[kevinb]

I requested something similar a couple of months ago, http://forum.directadmin.com/showthread.php?t=45804

Replacing FTP with sFTP doesn't help with compromised passwords.

 

[zEitEr]

5 minutes of time to code a script to sync iptables with /etc/virtual/pophosts. Just block TCP 21 (incoming) for all and allow only for those in the list.